[su_heading size=”18″ margin=”40″]Another software vulnerability affects the products of internet giants. The extremely dangerous vulnerability called FalseCONNECT lies in solutions and applications that handle proxy connections.[/su_heading]
Security researcher Jerry Decime has revealed details about the FalseCONNECT vulnerability, which allows an attacker to conduct Man-in-the-Middle by rerouting HTTPS Traffic, thanks to flaws in the implementation of proxy in various software.
According to the researcher, there is a significant security gap in the way applications from various companies respond to HTTP CONNECT requests and “HTTP/1.0 407 Proxy Authentication Required” responses.
This security gap only manifests itself in network environments where users use proxy connections to connect online, which is often found in corporate networks with strong firewalls.
Decime explains that an attacker with access to a compromised network and the ability to monitor proxy traffic can also monitor HTTP CONNECT requests sent to the local proxy.
When the attacker detects an HTTP CONNECT request, he can respond himself instead of the real proxy server and send an “HTTP/1.0 407 Proxy Authentication Required” response, asking the user for a password to be able to access the desired service.
Since HTTP CONNECT requests are unencrypted, the attacker knows when the victim attempts to access sensitive accounts, such as email or intranet servers – even if these services are provided over HTTPS.
Thus, the attacker can force the user to authenticate, sending the responses back to him and stealing his access details.
[su_note note_color=”#d7dfe0″ radius=”7″]According to the US-CERT (Cyber Emergency Response Team), Webkit-based clients are particularly vulnerable to this vulnerability. Webkit technology is widely used in software such as Chrome, iTunes, Google Drive, Safari and many mobile applications.[/su_note]
Many software vendors develop applications that have the ability to handle proxy connections, and are therefore potentially vulnerable to the vulnerability. So far, Apple, Microsoft, Oracle, and Opera have acknowledged that their products are affected by FalseCONNECT, while Lenovo has stated that the bug does not affect its software.
Other software vendors still investigating whether they are affected by the vulnerability include Cisco, Google, HP, IBM, Juniper, Mozilla, Nokia, OpenBSD, SAP, Sony, Linux, and others.
More technical details about this security flaw can be found at the following link: https://falseconnect.com/
